← Back to SpendXRay

Privacy Policy

Last updated: April 12, 2026

Privacy Summary

The short version: SpendXRay is built to help you understand your purchases, not monetize your data.

  • We do not sell your personal data.
  • We do not use your purchase history for advertising.
  • We collect only the order and item data needed to run SpendXRay.
  • We do not collect your retailer passwords or payment card numbers.
  • When AI categorization runs, we send only the minimum item information needed for that task.

1. Introduction

SpendXRay ("we", "our", "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use the SpendXRay web application and the SpendXRay Importer Chrome extension (collectively, the "Service").

Our product only works if you trust us with sensitive spending information, so we try to keep our data practices narrow and easy to understand. We collect the minimum information we need to operate the Service, and we do not treat your data as an asset to resell or exploit.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

  • Name — used to personalize your account and any household sharing features you choose to use
  • Email address — used for authentication and account recovery
  • Password — stored in hashed form; we never store or have access to your plaintext password

2.2 Order and Purchase Data

When you use the Extension to import orders, we collect:

  • Order details — order numbers, order dates, and store identifiers
  • Item details — item names, prices, quantities, and product URLs
  • Shipping and tax amounts — if available on the order page

We do not collect:

  • Your retailer login credentials (usernames, passwords)
  • Payment information (credit card numbers, bank accounts)
  • Shipping addresses or personal contact details from retailer sites
  • Browsing history or activity outside of the specific order pages accessed during scraping

2.3 User-Generated Data

Data you create within the Service, including:

  • Spending categories you create or modify
  • HSA eligibility classifications you assign to items
  • Reimbursement records and notes

2.4 AI Processing Data

When you use our AI-powered categorization features, item names and descriptions may be sent to third-party AI providers for processing. We send only the minimum data necessary for categorization, such as item names and your category list. We do not send your email, order numbers, prices, shipping addresses, or payment information to AI providers for categorization.

2.5 Technical Data

We automatically collect limited technical data necessary to operate the Service:

  • Server logs (such as IP addresses, request timestamps, and browser type) for security, debugging, and service reliability

We do not use cookies for tracking or advertising. We use only essential session cookies required for authentication.

3. How We Use Your Information

We use your information solely to:

  • Provide, maintain, and improve the Service
  • Authenticate your account and authorize access
  • Store and display your order and spending data
  • Generate AI-assisted categorization suggestions
  • Send transactional emails (password resets, critical account notifications)

We do not:

  • Sell, rent, or share your personal data with third parties for marketing or advertising
  • Use your data to build advertising profiles
  • Use your imported purchase history to train our own advertising, data broker, or resale products
  • Use your data for any purpose other than providing the Service to you

4. Chrome Extension Specific Disclosures

In compliance with the Chrome Web Store Developer Program Policies:

4.1 Single Purpose

The SpendXRay Importer Extension has a single purpose: to import your order history from supported retailers into your SpendXRay account.

4.2 Permissions Justification

  • activeTab — Required to read order data from the retailer page you are currently viewing
  • storage — Required to store your authentication token locally so you remain signed in to SpendXRay
  • tabs — Required to navigate between order pages during the import process
  • scripting — Required to inject content scripts that extract order data from retailer pages
  • identity — Required for OAuth-based authentication with your SpendXRay account
  • alarms — Required to keep the extension service worker active during long-running import sessions
  • Host permissions for supported retailer sites and spendxray.com — Required to access order history pages on supported stores and authenticate with your SpendXRay account

4.3 Data Handling

The Extension:

  • Reads data only from order history pages on supported retailer websites
  • Transmits extracted order data exclusively to the SpendXRay server over HTTPS
  • Stores only an authentication token in local browser storage
  • Does not collect data from any other websites or browser activity
  • Does not inject advertising or tracking scripts
  • Does not communicate with any third-party servers other than the SpendXRay API

5. Data Storage and Security

Your data is stored on secured servers. We implement appropriate technical and organizational measures to protect your data, including:

  • Encryption of data in transit using TLS/HTTPS
  • Hashed password storage using industry-standard algorithms
  • OAuth 2.0 token-based authentication between the Extension and the server
  • Access controls limiting data access to authenticated account owners only

6. Data Sharing

We may share limited data with the following categories of third parties, solely for the purposes described:

  • AI service providers — limited item information only, for categorization. These providers process data under their own privacy policies and data processing agreements.
  • Infrastructure and communications providers — including DigitalOcean for hosting, Cloudflare for security and traffic delivery, SendGrid for transactional email delivery, and Expo for mobile app infrastructure and notifications.

We will also disclose your information if required by law, regulation, or legal process.

7. Data Retention

We retain your data for as long as your account is active. If you delete your account:

  • Your personal data and order history are deleted from the application as part of the account deletion process
  • Some limited records may be retained if required for legal, security, fraud prevention, billing, or compliance purposes

8. Your Rights

You have the right to:

  • Access your personal data through the Service
  • Correct inaccurate data through the Service
  • Delete your account and all associated data
  • Object to processing of your data for specific purposes

To exercise these rights, contact us at [email protected].

9. Children's Privacy

The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will promptly delete that information.

10. International Data Transfers

Your data may be stored and processed in the United States. By using the Service, you consent to the transfer of your data to the United States, which may have different data protection laws than your country of residence.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this page. Your continued use of the Service after changes are posted constitutes your acceptance of the revised Privacy Policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

[email protected]

Terms of Service